dexscreenerio[.]github[.]io

This domain, dexscreenerio.github.io, is currently under investigation for hosting a crypto credential theft operation. Analysis indicates the site is designed to harvest cryptocurrency wallet credentials, likely targeting users of decentralized finance (DeFi) platforms. The domain remains active as of the latest verification, with no explicit brand impersonation detected, though the naming convention suggests an attempt to mimic legitimate cryptocurrency analytics services. Infrastructure analysis reveals the domain is registered through GitHub Pages and resolves to the IP address 185.199.109.153, located in the United States under GitHub, Inc. The SSL certificate is issued by Let's Encrypt (R12), a common certificate authority for both legitimate and malicious sites. Despite its active status, the domain has not yet been flagged by VirusTotal vendors, with a detection score of 0/95. However, it appears on one security blocklist, specifically PhishDestroy, indicating preliminary identification as malicious. The page title, 'Site not found · GitHub Pages,' suggests either an attempt to evade detection or an incomplete deployment of the phishing infrastructure. The current risk assessment categorizes this domain as active and under investigation, with a focus on its potential to facilitate cryptocurrency credential theft. Organizations and individuals are advised to block access to this domain at the network level, particularly in environments where cryptocurrency transactions or DeFi interactions occur. End-users should verify the authenticity of any cryptocurrency-related websites, especially those hosted on public repository services like GitHub Pages. Monitoring for further blocklist inclusions and VirusTotal detections is recommended to assess evolving threats associated with this infrastructure.